Prompt injection: when AI reads instructions you never gave it

An AI assistant receives instructions from you.

That sounds simple enough.

But increasingly, AI systems also read websites, emails, documents, search results and information from connected applications. Some of that content can contain instructions too.

That creates a security problem known as prompt injection.

The simple version

Imagine asking an AI assistant to summarise a customer support email.

Hidden inside the message is text aimed not at you, but at the AI: an instruction telling it to ignore your request, reveal information from the wider conversation, or take some other action.

A person reading the email might never notice it. An AI processing the message may still parse it as part of the context it needs to follow. OWASP notes that prompt injections do not need to be human-visible or readable if the model can process them.

That is the essential problem: you did not give the AI that instruction. Something it encountered while completing your task did.

OWASP describes prompt injection as a vulnerability in which prompts or external content alter an LLM's behaviour or output in unintended ways. OpenAI similarly describes prompt injection as a form of social engineering aimed at getting an AI to do something the user did not ask for.

Why this matters more now

Prompt injection is less consequential when an AI can only produce text inside an isolated chat.

The picture changes when the same system can also:

• read email
• access documents
• browse authenticated websites
• use business systems
• send messages
• upload or modify files
• make purchases
• run software

The hidden instruction itself is not automatically catastrophic. The serious risk appears when manipulated content is combined with access to private information or tools that can take real actions.

A malicious instruction could potentially be placed inside a webpage, email, document, support ticket, product listing or another source an AI has been asked to process. In some cases, the result may simply be a wrong or biased answer. In higher-impact cases, it could lead to sensitive information being exposed or an action being taken that nobody intended to approve.

OpenAI's November 2025 guidance describes prompt injection as an evolving security challenge because modern agents can combine untrusted external content with private data and real actions.

Direct and indirect prompt injection

Two forms are particularly useful to understand.

Direct prompt injection happens when the user's own prompt directly changes the model's behaviour in an unintended way. That can be deliberate, such as someone trying to override safeguards, or accidental, such as pasting content that contains instructions the user did not realise were there.

Indirect prompt injection happens when the problematic instruction comes from an external source the AI is processing, such as a website, file or email.

The person operating the AI may never see the instruction at all.

That second category becomes especially important as AI systems work across more external data sources and connected tools.

A useful comparison with social engineering

Traditional cybersecurity often focuses on exploiting software flaws.

Prompt injection can look different. In many cases, the attacker is effectively trying to persuade the AI.

A phishing email tries to convince a person to take an action they should not take. A prompt injection tries to convince an AI to take an action its user did not request.

That does not mean the two problems are identical, but the comparison is useful: the target is decision-making rather than necessarily the software underneath it.

OpenAI's March 2026 article on designing agents to resist prompt injection makes this same connection, arguing that effective attacks increasingly resemble social engineering rather than simple prompt overrides.

The AI still needs somewhere dangerous to go

Prompt injection alone does not automatically create a serious incident.

The potential impact depends heavily on what the AI is allowed to access and do.

An AI reading a malicious email with no access to anything else may produce a poor summary or recommendation.

An AI that can also access confidential files and send external messages presents a much bigger risk.

This is why prompt injection and permissions are closely connected. Security is not only about stopping manipulation. It is also about limiting what can happen if manipulation succeeds.

Can it simply be filtered out?

Not reliably.

Obvious phrases such as “ignore all previous instructions” can sometimes be detected, but real attacks do not need to look that simple.

Instructions can be disguised, fragmented, hidden from normal view or written to look like ordinary content. Distinguishing information about an instruction from an instruction the AI should actually follow is also difficult.

That is why modern defences tend to be layered rather than relying on a single filter. They can include model training, monitoring, clearer separation between trusted instructions and untrusted external content, permission controls, restricted tools and human confirmation before sensitive actions.

OWASP notes that techniques such as retrieval-augmented generation and fine-tuning do not, by themselves, fully solve prompt injection.

What users can do

Before enabling an AI connector or agent, check two things:

• What can it read? Give it access only to the information it actually needs.
• What can it do? Require confirmation before consequential actions such as sending, paying, deleting, publishing or sharing information outside the organisation.

The same caution applies even without a fully autonomous agent. If you paste an email, document or webpage into a chat, the AI is still processing content that may contain instructions you did not write.

Treat external content an AI reads as potentially untrusted.

That does not mean AI agents are inherently unsafe.

It means giving an AI access to a public webpage is different from giving it access to your inbox, private files and the ability to act on your behalf.

The more capable the assistant becomes, the more important those boundaries become.

Key takeaways

• Prompt injection can manipulate AI through instructions in user input or external content the AI processes.
• Direct prompt injection can be intentional or accidental; indirect injection can arrive through websites, emails, files and other sources.
• Hidden instructions do not need to be visible to a person if the AI can parse them.
• Risk grows when an AI can access sensitive data or take actions in connected systems.
• Least privilege and human confirmation can reduce the impact even when manipulation is not fully prevented.

A note on changing products

AI security controls and agent capabilities change quickly. securedby.ai re-opened and reviewed the sources above on 14 September 2026. Recheck current provider and standards documentation before making a high-stakes security decision.